fix: improve security, session handling, and UI responsiveness for topic management and document rendering

materials/routes.py

@@ -36,7 +36,7 @@ def _validate_pdf_upload(file: UploadFile) -> None:
     if size is not None and size > MAX_SIZE_BYTES:
         raise HTTPException(400, "File too large")
     if size is None:
-        raise HTTPException(400, "File too large")
+        raise HTTPException(400, "Could not determine file size")
 
 class URLInput(BaseModel):
     url: str
@@ -247,13 +247,18 @@ async def create_topic(
     body: TopicRequest,
     user_id: str = Depends(get_current_user_id)
 ):
-    if is_title_taken(body.topic, user_id=user_id):
-        raise HTTPException(409, "You already have a material with this title")
-    mat = create_material(
-        user_id=user_id,
-        title=body.topic.strip(),
-        source_type="topic"
-    )
+    # Rely on the DB-level UNIQUE constraint on (user_id, title)
+    try:
+        mat = create_material(
+            user_id=user_id,
+            title=body.topic.strip(),
+            source_type="topic"
+        )
+    except APIError as e:
+        # Supabase raises APIError with code "23505" on unique-constraint violations
+        if "23505" in str(e) or "duplicate" in str(e).lower() or "unique" in str(e).lower():
+            raise HTTPException(409, "You already have a material with this title")
+        raise HTTPException(500, f"Failed to create topic: {e}")
     update_material_status(mat["id"], "ready", "Topic ready")
     return {"material_id": mat["id"], "title": mat["title"]}
 
@@ -267,13 +272,6 @@ def search_materials(
     body: SearchRequest,
     user_id: str = Depends(get_current_user_id),
 ):
-    # Debug logs
-    headers = {k.lower(): v for k, v in request.headers.items()}
-    logger.info(f"[search] user_id={user_id}")
-    logger.info(f"[search] x-auth-token present: {'x-auth-token' in headers}")
-    logger.info(f"[search] authorization present: {'authorization' in headers}")
-    logger.info(f"[search] query={body.q}")
-
     supabase = get_supabase()
     if not supabase:
         return {"results": []}
@@ -283,7 +281,6 @@ def search_materials(
         {"p_query": body.q, "p_user_id": user_id}
     ).execute()
 
-    logger.info(f"[search] RPC returned {len(result.data)} results: {result.data}")
     return {"results": result.data}
     
 @router.delete("/{material_id}")

quiz_generator/routes.py

@@ -142,4 +142,8 @@ async def load_results(
     quiz_id: str,
     user_id: str = Depends(get_current_user_id),
 ):
+    # Verify the quiz belongs to the requesting user before returning results
+    quizzes = get_quizzes(user_id=user_id)
+    if not any(q.get("id") == quiz_id for q in quizzes):
+        raise HTTPException(403, "Access denied")
     return get_quiz_results(quiz_id)

rag/rag.py

@@ -77,7 +77,7 @@ async def store_embeddings_async(material_id: str, chunk_ids: list[str], chunks:
     await embedding_queue.put(job)
     await job.done.wait()
 
-    entry = job_store[job.job_id]
+    entry = job_store.pop(job.job_id)
     if entry["status"] == "error":
         raise RuntimeError(f"Embedding failed: {entry['error']}")
 

rag/routes.py

@@ -155,8 +155,11 @@ async def create_session(
 @router.get("/sessions/{session_id}/messages")
 async def get_messages(
     session_id: str,
-    current_user=Depends(get_current_user),
+    user_id: str = Depends(get_current_user_id),
 ):
+    session = get_chat_session(session_id)
+    if not session or session.get("user_id") != user_id:
+        raise HTTPException(403, "Access denied")
     messages = get_session_messages(session_id)
     return messages
 
@@ -167,6 +170,9 @@ async def rename_session(
     body: RenameSessionRequest,
     user_id: str = Depends(get_current_user_id),
 ):
+    session = get_chat_session(session_id)
+    if not session or session.get("user_id") != user_id:
+        raise HTTPException(403, "Access denied")
     rename_chat_session(session_id, body.title)
     return {"status": "ok"}
 
@@ -176,6 +182,9 @@ async def delete_session(
     session_id: str,
     user_id: str = Depends(get_current_user_id),
 ):
+    session = get_chat_session(session_id)
+    if not session or session.get("user_id") != user_id:
+        raise HTTPException(403, "Access denied")
     delete_chat_session(session_id)
     return {"status": "ok"}
 
@@ -192,6 +201,9 @@ async def extract_title(
 ):
     try:
         session = get_chat_session(session_id)
+        if not session or session.get("user_id") != user_id:
+            raise HTTPException(403, "Access denied")
+        
         material_title = None
         if session and session.get("material_id"):
             mat = get_material(session["material_id"])

store.py

@@ -320,11 +320,18 @@ def save_summary(material_id: str, user_id: str, summary: str,
         "time_taken": time_taken,
         "model_name": model_name,
     }
-    existing = _table_supabase("summaries").select("*").eq("material_id", material_id).execute()
-    if existing.data:
-        _table_supabase("summaries").update(data).eq("material_id", material_id).execute()
+    # Single atomic upsert — eliminates the race between select→insert/update
+    # under concurrent summarization requests (both see no row → both insert → 500).
+    client = _db()
+    if client is not None:
+        _robust_execute(client.table("summaries").upsert(data, on_conflict="material_id"))
     else:
-        _table_supabase("summaries").insert(data).execute()
+        # Offline / dev fallback: manual check-then-write (no concurrency risk in dev)
+        existing = _FakeTable("summaries").select("*").eq("material_id", material_id).execute()
+        if existing.data:
+            _FakeTable("summaries").update(data).eq("material_id", material_id).execute()
+        else:
+            _FakeTable("summaries").insert(data).execute()
 
 
 def get_summary(material_id: str) -> Optional[dict]:
@@ -365,14 +372,13 @@ def save_quiz(user_id: str, material_id: Optional[str], source_type: str,
 
 
 def get_quizzes(material_id: Optional[str] = None, user_id: Optional[str] = None) -> list[dict]:
-    tbl = _table_supabase("quizzes")
-    result = tbl.select("*").execute()
-    records = result.data
-    if material_id:
-        records = [r for r in records if r.get("material_id") == material_id]
+    query = _table_supabase("quizzes").select("*")
     if user_id:
-        records = [r for r in records if r.get("user_id") == user_id]
-    return records
+        query = query.eq("user_id", user_id)
+    if material_id:
+        query = query.eq("material_id", material_id)
+    result = _robust_execute(query)
+    return result.data
 
 
 # ── Users (maps to Supabase `profiles` table) ─────────
@@ -638,57 +644,61 @@ def get_or_create_memory(memory_id: Optional[str] = None, seed_messages: list[di
 def check_and_increment_daily_limit(user_id: str, email: Optional[str] = None, limit: int = 10) -> bool:
     """
     Returns True if request is allowed, False if limit exceeded.
-    Excludes Admin Emails from Limits
+    Excludes Admin Emails from Limits.
+
+    Uses a single atomic SQL UPDATE via Supabase RPC to eliminate the
+    check-then-increment race condition (two concurrent reads both see
+    count=9, both pass, both increment → 11th request gets through).
     """
-    # Exclude specific email from rate limiting
-    if email in ADMIN_EMAILS:
+    # Guard: never apply limit to admin emails
+    if email and email in ADMIN_EMAILS:
         return True
 
-    today = date.today().isoformat()
+    client = _db()
+    if client is not None:
+        try:
+            result = client.rpc(
+                "increment_daily_limit",
+                {"p_user_id": user_id, "p_limit": limit},
+            ).execute()
+            if not result.data:
+                return False
+            return True
+        except Exception as e:
+            logger.warning(f"Atomic rate-limit RPC failed, falling back to two-query path: {e}")
+            # Fall through to the two-query fallback below
 
+    # ── Offline / dev fallback (also used when RPC call above raises) ──────────
+    # This path has a theoretical race condition but is acceptable for single-
+    # worker dev environments where the RPC is not available.
+    today = date.today().isoformat()
     try:
-        # Get current profile
         result = _robust_execute(
             _table_supabase("profiles")
             .select("daily_requests, last_request_date")
             .eq("id", user_id)
-            
         )
-        
-        # If no profile or data, allow (or we could create one, but usually it exists)
         if not result.data:
             return True
-        
-        # Handle both single object or list response from maybe_single/execute
         profile = result.data[0] if result.data else None
         if not profile:
             return True
 
         last_date = profile.get("last_request_date")
         count = profile.get("daily_requests", 0) or 0
-
-        # Reset count if it's a new day
         if last_date != today:
             count = 0
-
-        # Check limit
         if count >= limit:
             return False
 
-        # Increment
         _robust_execute(
             _table_supabase("profiles")
-            .update({
-                "daily_requests": count + 1,
-                "last_request_date": today,
-            })
+            .update({"daily_requests": count + 1, "last_request_date": today})
             .eq("id", user_id)
         )
         return True
     except Exception as e:
-        # If DB fails, we default to allowing the request to not break the app
-        import logging
-        logging.getLogger(__name__).error(f"Rate limit check failed: {e}")
+        logger.error(f"Rate limit check failed: {e}")
         return True
 
 

summary_generator/routes.py

@@ -49,6 +49,8 @@ async def generate_summary(
             if not chunks_list:
                 raise HTTPException(400, "No text chunks found in this material")
             combined = "\n".join(c["content"] for c in chunks_list)
+            if len(combined) > 80000:
+                combined = combined[:80000]
             summary = await loop.run_in_executor(None, summarizer, combined)
 
         elapsed = time.time() - start